Description
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.17, OTP 27.3.4.8, and OTP 28.3.2, corresponding to inets from 5.10 before 7.0, and tftp from 1.0 before 1.1.1.1, 1.2.2.1, and 1.2.4.
References9
- cna.erlef.org/cves/CVE-2026-21620.html
- github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3a…
- github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960…
- github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833…
- github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8…
- github.com/erlang/otp/pull/10706
- github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
- osv.dev/vulnerability/EEF-CVE-2026-21620
- www.erlang.org/doc/system/versions.html#order-of-versions
Metrics
- CVSS 4.0
-
2.3
LOW
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 49 · as of 12 November 2026
- CWE
- CWE-23
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.